Over the last decade, cybersecurity attacks have become a pervasive problem for internet users as many networked devices and other resources have been subjected to attack and compromised. The attack may involve the infiltration of malicious software onto a network device or concentration on an exploit residing within a network device to perpetrate the cybersecurity attack (generally referred to as “malware”).
Recently, malware detection has undertaken three different approaches. One approach involves the installation of anti-virus software within network devices forming an enterprise network. Given that advanced malware is able to circumvent anti-virus analysis, this approach has been determined to be deficient.
Another approach involves the placement of dedicated malware detection appliances at various ingress points throughout a network or subnetwork. The malware detection appliances are configured to extract information propagating over the network at the ingress point, analyze the information to determine a level of suspiciousness, and conduct malware analysis internally within the appliance itself. While successful in detecting advanced malware that is attempting to infect network devices connected to the network (or subnetwork), as network traffic increases, this appliance-based approach may exhibit resource constraints. Stated differently, the dedicated, malware detection appliance has a prescribed (and finite) amount of resources (for example, bandwidth and processing power) that, once fully in use, requires either the malware detection appliance to resort to more selective traffic inspection or additional (and/or upscaled) malware detection appliances to be installed. The later solution requires a large outlay of capital and network downtime, as IT resources are needed to install the new malware detection appliances. Also, these dedicated, malware detection appliances provide limited scalability and flexibility in deployment.
Yet another approach involves the use of exclusive, cloud-based malware detection appliances. However, this exclusive, cloud-based solution suffers from a number of disadvantages, including the inability of providing on-site deployment of resources at an enterprise's premises (e.g., as devices that are part of the enterprise's network infrastructure). On-site deployment may be crucial for compliance with requirements as to personally identifiable information (PII) and other sensitive information including those mandated at local, state, country or regional governmental levels.
To achieve increased scalability, the architecture involved in malware detection requires a high level of availability. In other words, the architecture needs to be configured to mitigate disruption of malware analysis services due to a single point of failure. Without high availability, system-wide, malware detection services may be disrupted in response to failure of a single component.